@kici-dev/engine 0.1.27 → 0.2.0

package/dist/protocol/messages/dashboard.js

@@ -3,7 +3,9 @@ import { CheckMode, CheckStepOutcome } from "../../check-mode.js";
 import { SourceOrigin } from "../source-origin.js";
 import { AttestationOrigin } from "../../provenance/attestation-origin.js";
 import { actorPrincipalSchema } from "./actor.js";
-import { StepConcurrencyKind, initFailureSchema } from "./execution-status.js";
+import { HeldRunStatus } from "../../context/held-run-status.js";
+import { dashboardSealedEnvelopeSchema } from "./dashboard-sealed-write.js";
+import { StepConcurrencyKind, initFailureSchema, stateReplayRunSchema } from "./execution-status.js";
 import { agentRunResultSchema } from "./agent-run-result.js";
 import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
@@ -15,6 +17,7 @@ import { ScalerBackendType } from "../../scaler/scaler-backend-type.js";
 import { ApprovalDecision, HoldScope, approverClauseSchema } from "../../approval/types.js";
 import { NeedsRunOn, OnUnreachableMode } from "../../trigger/types.js";
 import { HostTargetSelector } from "../../labels-match.js";
+import { ConcurrencyStrategy } from "../../context/concurrency-strategy.js";
 import { HostInventoryEntry } from "../../inventory.js";
 import { globalWorkflowsGetRequestSchema, globalWorkflowsGetResponseSchema, globalWorkflowsUpdateRequestSchema, globalWorkflowsUpdateResponseSchema } from "./dashboard-global-workflows.js";
 import { z } from "zod";
@@ -44,6 +47,31 @@ const dashboardRunStructuredResponseSchema = z.object({
 	result: agentRunResultSchema.nullable(),
 	error: z.string().optional()
 });
+/**
+* Request the current mirror-projection state of a single run from the
+* orchestrator. Unlike `dashboard.run.detail` (a user-plane read that
+* access-logs), this is a **system reconciliation read**: the Platform's
+* `RunMirrorReconciler` issues it for a run stuck non-terminal in the mirror to
+* recover a terminal frame dropped on a live connection. The `actor` is always a
+* `system` principal, and the orchestrator does NOT write an access-log row.
+*/
+const dashboardRunStateRequestSchema = z.object({
+	type: z.literal("dashboard.run.state"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string()
+});
+/**
+* Response carrying the run's current `StateReplayRun` mirror-projection shape
+* (the same shape `state.replay` carries), or `run: null` when the orchestrator
+* has no such run. Consumed by `upsertRunMirror` on the Platform side.
+*/
+const dashboardRunStateResponseSchema = z.object({
+	type: z.literal("dashboard.run.state.response"),
+	requestId: z.string(),
+	run: stateReplayRunSchema.nullable(),
+	error: z.string().optional()
+});
 /** Request step logs from orchestrator. */
 const dashboardStepLogsRequestSchema = z.object({
 	type: z.literal("dashboard.step.logs"),
@@ -239,6 +267,50 @@ const dashboardAttestationsListResponseSchema = z.object({
 	type: z.literal("dashboard.attestations.list.response"),
 	requestId: z.string(),
 	attestations: z.array(attestationListItemSchema),
+	/**
+	* The provenance issuer that signs this orchestrator's attestations, when it
+	* owns signing (`KICI_ORCHESTRATOR_PROVENANCE_ISSUER`). The Platform surfaces
+	* it as `trustedIssuer` so the dashboard / CLI verify against the orchestrator
+	* that actually signed the bundles; absent → the Platform falls back to its own
+	* issuer (for historical Platform-signed bundles). Optional for backward
+	* compatibility with older orchestrators.
+	*/
+	trustedIssuer: z.string().nullable().optional(),
+	error: z.string().optional()
+});
+/** Request the named artifacts uploaded by a run. */
+const dashboardArtifactsListRequestSchema = z.object({
+	type: z.literal("dashboard.artifacts.list"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	runId: z.string()
+});
+/**
+* Single artifact in the list response. `downloadUrl` is a presigned GET the
+* dashboard links directly; it is omitted when the backing object could not be
+* resolved (expired / missing), in which case the row still lists the metadata.
+*/
+const artifactListItemSchema = z.object({
+	name: z.string(),
+	jobId: z.string(),
+	sizeBytes: z.number(),
+	sha256: z.string(),
+	createdAt: z.string(),
+	downloadUrl: z.string().optional()
+});
+/** Response with the run's artifacts (correlates to dashboard.artifacts.list). */
+const dashboardArtifactsListResponseSchema = z.object({
+	type: z.literal("dashboard.artifacts.list.response"),
+	requestId: z.string(),
+	artifacts: z.array(artifactListItemSchema),
+	/**
+	* Signature-validity window (seconds) of the presigned `downloadUrl`s in this
+	* response, from the storage backend's presigned-GET expiry; the dashboard
+	* refreshes the list on a fraction of it so a displayed link is never stale.
+	* Optional for backward compatibility with older orchestrators (mirrors
+	* `trustedIssuer`).
+	*/
+	downloadUrlExpiresInSeconds: z.number().int().positive().optional(),
 	error: z.string().optional()
 });
 /**
@@ -301,6 +373,8 @@ const dashboardAttestationsListAllResponseSchema = z.object({
 	page: z.number().int(),
 	pageSize: z.number().int(),
 	total: z.number().int(),
+	/** See `dashboardAttestationsListResponseSchema.trustedIssuer`. */
+	trustedIssuer: z.string().nullable().optional(),
 	error: z.string().optional()
 });
 /** Request a single attestation by id (detail page; inlines the one bundle). */
@@ -499,6 +573,12 @@ const runCancelResponseSchema = z.object({
 	type: z.literal("run.cancel.response"),
 	requestId: z.string(),
 	cancelledJobs: z.number().optional(),
+	/**
+	* True when the run was already terminal, so the cancel wrote nothing. Optional
+	* so an orchestrator that predates the field still parses: an absent value
+	* means "not reported", not "false".
+	*/
+	alreadyTerminal: z.boolean().optional(),
 	error: z.string().optional()
 });
 /** Request the original webhook payload for a run. */
@@ -601,6 +681,36 @@ const dashboardEventLogDetailResponseSchema = z.object({
 	item: eventLogListItemSchema.optional(),
 	error: z.string().optional()
 });
+/** Aggregate webhook-activity counts for a time window (org-scoped).
+*  Powers the Runs-page misconfig strip + the `kici runs` hint. No payloads,
+*  no repo identifiers — safe for all org members. */
+const dashboardEventLogActivityRequestSchema = z.object({
+	type: z.literal("dashboard.event-log.activity"),
+	requestId: z.string(),
+	actor: actorPrincipalSchema,
+	orgId: z.string(),
+	/** ISO timestamp lower bound (inclusive). */
+	fromTimestamp: z.string(),
+	/** ISO timestamp upper bound (exclusive). */
+	toTimestamp: z.string()
+});
+/** Orchestrator-only bucketed counts over the window. `matched`/`unmatched`
+*  distinguish a trigger-no-match delivery from one that produced a run — a
+*  fact the Platform relay cannot compute (see the two-table architecture). */
+const eventLogActivityCountsSchema = z.object({
+	total: z.number(),
+	matched: z.number(),
+	unmatched: z.number(),
+	lockfileMissing: z.number(),
+	lockfileCorrupt: z.number(),
+	failed: z.number()
+});
+const dashboardEventLogActivityResponseSchema = z.object({
+	type: z.literal("dashboard.event-log.activity.response"),
+	requestId: z.string(),
+	counts: eventLogActivityCountsSchema.optional(),
+	error: z.string().optional()
+});
 /**
 * Reasons a chunked event-log payload stream may terminate without a body.
 * The terminal chunk carries `isLast=true` plus one of these codes in
@@ -758,7 +868,6 @@ const dashboardEventDlqDiscardResponseSchema = z.object({
 	error: z.string().optional()
 });
 const contextTypeSchema = z.enum(["fixed", "glob"]);
-const concurrencyStrategySchema = z.enum(["queue", "cancel-pending"]);
 /** List all contexts for the org. */
 const contextListRequestSchema = z.object({
 	type: z.literal("dashboard.contexts.list"),
@@ -819,7 +928,7 @@ const contextGetResponseSchema = z.object({
 		globPattern: z.string().nullable(),
 		branchRestrictions: z.array(z.string()).nullable(),
 		concurrencyLimit: z.number().nullable(),
-		concurrencyStrategy: concurrencyStrategySchema.nullable(),
+		concurrencyStrategy: ConcurrencyStrategy.nullable(),
 		requiredReviewers: z.number().nullable(),
 		waitTimerSeconds: z.number().nullable(),
 		holdExpirySeconds: z.number().nullable(),
@@ -839,11 +948,11 @@ const contextCreateRequestSchema = z.object({
 	contextType: contextTypeSchema,
 	globPattern: z.string().optional(),
 	branchRestrictions: z.array(z.string()).optional(),
-	concurrencyLimit: z.number().optional(),
-	concurrencyStrategy: concurrencyStrategySchema.optional(),
+	concurrencyLimit: z.number().int().positive().optional(),
+	concurrencyStrategy: ConcurrencyStrategy.optional(),
 	requiredReviewers: z.number().optional(),
 	waitTimerSeconds: z.number().optional(),
-	holdExpirySeconds: z.number().optional(),
+	holdExpirySeconds: z.number().int().positive().optional(),
 	enabled: z.boolean().optional()
 });
 const contextCreateResponseSchema = z.object({
@@ -863,11 +972,11 @@ const contextUpdateRequestSchema = z.object({
 		contextType: contextTypeSchema.optional(),
 		globPattern: z.string().nullable().optional(),
 		branchRestrictions: z.array(z.string()).nullable().optional(),
-		concurrencyLimit: z.number().nullable().optional(),
-		concurrencyStrategy: concurrencyStrategySchema.nullable().optional(),
+		concurrencyLimit: z.number().int().positive().nullable().optional(),
+		concurrencyStrategy: ConcurrencyStrategy.nullable().optional(),
 		requiredReviewers: z.number().nullable().optional(),
 		waitTimerSeconds: z.number().nullable().optional(),
-		holdExpirySeconds: z.number().nullable().optional(),
+		holdExpirySeconds: z.number().int().positive().nullable().optional(),
 		enabled: z.boolean().optional()
 	})
 });
@@ -930,16 +1039,25 @@ const contextVarsListResponseSchema = z.object({
 	})).optional(),
 	error: z.string().optional()
 });
-/** Set (create or update) a variable on an context. */
+/**
+* Set (create or update) a variable on an context.
+*
+* Under the `permissive` posture the browser sends the plaintext `value`.
+* Under the `encrypted` posture it sends a `sealed` envelope instead (the value
+* sealed to the orchestrator's X25519 key in the browser). Exactly one of
+* `value` / `sealed` is present; `value` stays optional for backward
+* compatibility with older dashboards that only ever send plaintext.
+*/
 const contextVarSetRequestSchema = z.object({
 	type: z.literal("dashboard.contexts.variables.set"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
 	contextId: z.string(),
 	key: z.string(),
-	value: z.string(),
+	value: z.string().optional(),
+	sealed: dashboardSealedEnvelopeSchema.optional(),
 	locked: z.boolean().optional()
-});
+}).refine((m) => m.value === void 0 !== (m.sealed === void 0), { message: "exactly one of value / sealed must be present" });
 const contextVarSetResponseSchema = z.object({
 	type: z.literal("dashboard.contexts.variables.set.response"),
 	requestId: z.string(),
@@ -1056,15 +1174,24 @@ const contextSecretsListResponseSchema = z.object({
 	})).optional(),
 	error: z.string().optional()
 });
-/** Set (create or update) a scoped secret. */
+/**
+* Set (create or update) a scoped secret.
+*
+* Under the `permissive` posture the browser sends the plaintext `value`.
+* Under the `encrypted` posture it sends a `sealed` envelope instead (the value
+* sealed to the orchestrator's X25519 key in the browser). Exactly one of
+* `value` / `sealed` is present; `value` stays optional for backward
+* compatibility with older dashboards that only ever send plaintext.
+*/
 const contextSecretSetRequestSchema = z.object({
 	type: z.literal("dashboard.contexts.secrets.set"),
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
 	scope: z.string(),
 	key: z.string(),
-	value: z.string()
-});
+	value: z.string().optional(),
+	sealed: dashboardSealedEnvelopeSchema.optional()
+}).refine((m) => m.value === void 0 !== (m.sealed === void 0), { message: "exactly one of value / sealed must be present" });
 const contextSecretSetResponseSchema = z.object({
 	type: z.literal("dashboard.contexts.secrets.set.response"),
 	requestId: z.string(),
@@ -1143,15 +1270,9 @@ const contextHistoryResponseSchema = z.object({
 		completedAt: z.coerce.string().nullable(),
 		context: z.string().nullable()
 	})).optional(),
+	hasMore: z.boolean().optional(),
 	error: z.string().optional()
 });
-/** Status values for held runs (approval queue). */
-const HeldRunStatus = z.enum([
-	"pending",
-	"approved",
-	"rejected",
-	"expired"
-]);
 /** Queue type for held runs. */
 const HeldRunQueueType = z.enum(["context", "security"]);
 /** List held runs. */
@@ -1163,6 +1284,14 @@ const heldRunsListRequestSchema = z.object({
 	queueType: HeldRunQueueType.optional(),
 	runId: z.string().optional(),
 	/**
+	* Narrow to a single hold by its `held_runs.id`. The Platform's held-run
+	* approval gate uses this to resolve one hold's `holdType` before deciding
+	* which permission the caller needs. Optional so an orchestrator that does
+	* not know the field still answers the request — the Platform then narrows
+	* client-side from the response.
+	*/
+	heldRunId: z.string().optional(),
+	/**
 	* Target org the read must be scoped to, carried per-request by the Platform
 	* (the validated `:orgId` path param). The orchestrator honors this over its
 	* static connection-level org so a Platform-first `kici run remote` org —
@@ -1182,8 +1311,8 @@ const heldRunsListResponseSchema = z.object({
 		contextId: z.string().nullable(),
 		contextName: z.string().nullable(),
 		holdType: z.string(),
-		queueType: HeldRunQueueType,
-		status: HeldRunStatus,
+		queueType: z.string(),
+		status: z.string(),
 		requestedAt: z.coerce.string(),
 		resolvedAt: z.coerce.string().nullable(),
 		resolvedBy: z.string().nullable(),
@@ -1859,11 +1988,13 @@ const testRelayCancelResponseSchema = z.object({
 const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailRequestSchema,
 	dashboardRunStructuredRequestSchema,
+	dashboardRunStateRequestSchema,
 	dashboardStepLogsRequestSchema,
 	dashboardAttestationsListRequestSchema,
 	dashboardAttestationsListAllRequestSchema,
 	dashboardAttestationGetRequestSchema,
 	dashboardAttestationRetryRequestSchema,
+	dashboardArtifactsListRequestSchema,
 	dashboardRunsListRequestSchema,
 	dashboardRunsFiltersRequestSchema,
 	dashboardSourcesListRequestSchema,
@@ -1914,6 +2045,7 @@ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 	backendSyncRequestSchema,
 	backendTestRequestSchema,
 	dashboardEventLogListRequestSchema,
+	dashboardEventLogActivityRequestSchema,
 	dashboardEventLogDetailRequestSchema,
 	dashboardEventLogPayloadStreamRequestSchema,
 	dashboardEventDlqListRequestSchema,
@@ -1933,11 +2065,13 @@ const dashboardPlatformToOrchSchema = z.discriminatedUnion("type", [
 const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	dashboardRunDetailResponseSchema,
 	dashboardRunStructuredResponseSchema,
+	dashboardRunStateResponseSchema,
 	dashboardStepLogsResponseSchema,
 	dashboardAttestationsListResponseSchema,
 	dashboardAttestationsListAllResponseSchema,
 	dashboardAttestationGetResponseSchema,
 	dashboardAttestationRetryResponseSchema,
+	dashboardArtifactsListResponseSchema,
 	dashboardRunsListResponseSchema,
 	dashboardRunsFiltersResponseSchema,
 	dashboardSourcesListResponseSchema,
@@ -1988,6 +2122,7 @@ const dashboardOrchToPlatformSchema = z.discriminatedUnion("type", [
 	backendSyncResponseSchema,
 	backendTestResponseSchema,
 	dashboardEventLogListResponseSchema,
+	dashboardEventLogActivityResponseSchema,
 	dashboardEventLogDetailResponseSchema,
 	dashboardEventLogPayloadChunkSchema,
 	dashboardEventDlqListResponseSchema,
@@ -2092,13 +2227,21 @@ const runListItemSchema = z.object({
 	localWorkingTree: z.boolean(),
 	source: runListSourceSchema.nullable()
 });
-/** Paginated run list response envelope. */
+/**
+* Cursor-paginated run list response envelope.
+*
+* Keyset (cursor) pagination: `nextCursor` fetches the next (older) page,
+* `prevCursor` the previous (newer) page — both opaque, `null` when there is no
+* such page. `hasMore` is true when an older page exists. `approxTotal` is a
+* cached, approximate match count for the "~N runs" label (not an exact total).
+*/
 const runListResponseSchema = z.object({
 	runs: z.array(runListItemSchema),
-	total: z.number(),
-	page: z.number(),
-	pageSize: z.number(),
-	hasMore: z.boolean()
+	nextCursor: z.string().nullable(),
+	prevCursor: z.string().nullable(),
+	hasMore: z.boolean(),
+	approxTotal: z.number(),
+	pageSize: z.number()
 });
 const diagnosticsInfraAgentSchema = z.object({
 	agentId: z.string(),
@@ -2151,11 +2294,25 @@ const diagnosticsInfraOrchestratorSchema = z.object({
 	* Self-reported deployment shape, used by the dashboard to build the correct
 	* per-orchestrator kici-admin invocation. Orchestrators that never reported
 	* it serialize as `mode: 'unknown'` with null container fields.
+	*
+	* `adminInvocation` is a shell command, not a pair of raw paths: either half
+	* is single-quoted when its path holds whitespace, so it is rendered verbatim
+	* and a reader that wants the shim path back has to split it as shell words
+	* rather than on the last space.
+	*
+	* `adminPath` is the `windows` counterpart: the RAW, unquoted path of the
+	* `kici-admin.cmd` launcher, null for every other mode and whenever it could
+	* not be located. It is deliberately not a command — cmd.exe runs a
+	* double-quoted path in command position while PowerShell only prints it, so
+	* the renderer has to quote it per shell and a pre-quoted value would take
+	* that choice away.
 	*/
 	deployment: z.object({
 		mode: DeploymentModeSchema,
 		containerName: z.string().nullable(),
-		containerRuntime: DeploymentContainerRuntimeSchema.nullable()
+		containerRuntime: DeploymentContainerRuntimeSchema.nullable(),
+		adminInvocation: z.string().nullable(),
+		adminPath: z.string().nullable()
 	}),
 	s3LogAccess: z.boolean().nullable().optional(),
 	agentCount: z.number(),
@@ -2189,6 +2346,16 @@ const diagnosticsInfraOrchestratorSchema = z.object({
 	})).optional(),
 	error: z.string().optional()
 });
+/**
+* A single infrastructure health alert.
+*
+* Both vocabulary fields are `z.string()` on purpose. `InfraAlertType` and
+* `InfraAlertSeverity` (`diagnostics/infra-alert.ts`) name the *known*
+* vocabulary the producer mints from and the read-side consumers colour by; the
+* wire stays permissive because the `kici` CLI hard-parses this response while
+* pinned to an older version than the hosted Platform it is talking to. A
+* strict enum would fail the whole response rather than degrade one row.
+*/
 const diagnosticsInfraAlertSchema = z.object({
 	type: z.string(),
 	message: z.string(),
@@ -2285,6 +2452,6 @@ const DashboardResponseErrorCode = z.enum([
 	"internal_error"
 ]);
 //#endregion
-export { ContextDeleteErrorCode, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
+export { ContextDeleteErrorCode, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DashboardResponseErrorCode, EventLogPayloadStreamError, FleetHostDisposition, HeldRunQueueType, HeldRunStatus, TestRelayType, artifactListItemSchema, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, eventLogActivityCountsSchema, eventLogListItemSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, trustPolicyResponseSchema };
 
 //# sourceMappingURL=dashboard.js.map

package/dist/protocol/messages/deployment-identity.d.ts

@@ -1,38 +1,65 @@
 import { z } from 'zod';
 /** How the orchestrator process itself was deployed (not how it runs agents). */
 export declare const DeploymentModeSchema: z.ZodEnum<{
-    unknown: "unknown";
-    systemd: "systemd";
+    compose: "compose";
     launchd: "launchd";
+    systemd: "systemd";
+    unknown: "unknown";
     windows: "windows";
-    compose: "compose";
 }>;
 export type DeploymentMode = z.infer<typeof DeploymentModeSchema>;
 /** Container runtime that launched a `compose`-mode orchestrator. */
 export declare const DeploymentContainerRuntimeSchema: z.ZodEnum<{
-    podman: "podman";
     docker: "docker";
+    podman: "podman";
 }>;
 export type DeploymentContainerRuntime = z.infer<typeof DeploymentContainerRuntimeSchema>;
 /**
  * The orchestrator's self-reported deployment shape, used to build the correct
- * kici-admin invocation in the dashboard diagnostics page. Container fields are
+ * kici-admin invocation in the dashboard Infrastructure page. Container fields are
  * populated only for the `compose` mode; a hand-run orchestrator reports
- * `mode: 'unknown'` with no container fields.
+ * `mode: 'unknown'` with no container fields. `adminInvocation` is the pinned
+ * `<node> <kici-admin>` invocation for posix bare-metal (`systemd` / `launchd`),
+ * set by the orchestrator from its own `process.execPath` so a copied command
+ * runs under the unit's pinned runtime rather than whatever `node` the
+ * operator's shell resolves. The orchestrator locates the shim on disk and omits
+ * the field when it cannot, so a reader may always fall back to a PATH-resolved
+ * bare `kici-admin`. It is a live-host runtime path, carried only on the
+ * in-memory identity (never persisted).
+ *
+ * The value is a shell command, not a pair of raw paths: either half is
+ * single-quoted (POSIX `'\''` escaping) when its path holds whitespace or another
+ * shell metacharacter, so it can be pasted as-is. A reader that only displays it
+ * needs no special handling; a reader that wants the shim path back out has to
+ * split it as shell words rather than on the last space.
+ *
+ * `adminPath` is the Windows counterpart and is set only for `mode: 'windows'`:
+ * the absolute path of the `kici-admin.cmd` launcher, when the orchestrator can
+ * locate it. Unlike `adminInvocation` it is a RAW path and never a command —
+ * nothing about it is quoted or escaped. That is deliberate: cmd.exe runs a
+ * double-quoted path in command position while PowerShell merely *prints* it
+ * (it needs the `&` call operator), so the same path has to be written two
+ * different ways and only the reader knows which shell it is rendering for. A
+ * producer that pre-quoted would take that choice away. It is a live-host
+ * runtime path, carried only on the in-memory identity (never persisted), and
+ * omitted when the launcher cannot be located so a reader falls back to a
+ * PATH-resolved bare `kici-admin.cmd`.
  */
 export declare const DeploymentIdentitySchema: z.ZodObject<{
     mode: z.ZodEnum<{
-        unknown: "unknown";
-        systemd: "systemd";
+        compose: "compose";
         launchd: "launchd";
+        systemd: "systemd";
+        unknown: "unknown";
         windows: "windows";
-        compose: "compose";
     }>;
     containerName: z.ZodOptional<z.ZodString>;
     containerRuntime: z.ZodOptional<z.ZodEnum<{
-        podman: "podman";
         docker: "docker";
+        podman: "podman";
     }>>;
+    adminInvocation: z.ZodOptional<z.ZodString>;
+    adminPath: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type DeploymentIdentity = z.infer<typeof DeploymentIdentitySchema>;
 //# sourceMappingURL=deployment-identity.d.ts.map

package/dist/protocol/messages/deployment-identity.js

@@ -13,14 +13,41 @@ const DeploymentModeSchema = z.enum([
 const DeploymentContainerRuntimeSchema = z.enum(["podman", "docker"]);
 /**
 * The orchestrator's self-reported deployment shape, used to build the correct
-* kici-admin invocation in the dashboard diagnostics page. Container fields are
+* kici-admin invocation in the dashboard Infrastructure page. Container fields are
 * populated only for the `compose` mode; a hand-run orchestrator reports
-* `mode: 'unknown'` with no container fields.
+* `mode: 'unknown'` with no container fields. `adminInvocation` is the pinned
+* `<node> <kici-admin>` invocation for posix bare-metal (`systemd` / `launchd`),
+* set by the orchestrator from its own `process.execPath` so a copied command
+* runs under the unit's pinned runtime rather than whatever `node` the
+* operator's shell resolves. The orchestrator locates the shim on disk and omits
+* the field when it cannot, so a reader may always fall back to a PATH-resolved
+* bare `kici-admin`. It is a live-host runtime path, carried only on the
+* in-memory identity (never persisted).
+*
+* The value is a shell command, not a pair of raw paths: either half is
+* single-quoted (POSIX `'\''` escaping) when its path holds whitespace or another
+* shell metacharacter, so it can be pasted as-is. A reader that only displays it
+* needs no special handling; a reader that wants the shim path back out has to
+* split it as shell words rather than on the last space.
+*
+* `adminPath` is the Windows counterpart and is set only for `mode: 'windows'`:
+* the absolute path of the `kici-admin.cmd` launcher, when the orchestrator can
+* locate it. Unlike `adminInvocation` it is a RAW path and never a command —
+* nothing about it is quoted or escaped. That is deliberate: cmd.exe runs a
+* double-quoted path in command position while PowerShell merely *prints* it
+* (it needs the `&` call operator), so the same path has to be written two
+* different ways and only the reader knows which shell it is rendering for. A
+* producer that pre-quoted would take that choice away. It is a live-host
+* runtime path, carried only on the in-memory identity (never persisted), and
+* omitted when the launcher cannot be located so a reader falls back to a
+* PATH-resolved bare `kici-admin.cmd`.
 */
 const DeploymentIdentitySchema = z.object({
 	mode: DeploymentModeSchema,
 	containerName: z.string().min(1).optional(),
-	containerRuntime: DeploymentContainerRuntimeSchema.optional()
+	containerRuntime: DeploymentContainerRuntimeSchema.optional(),
+	adminInvocation: z.string().min(1).optional(),
+	adminPath: z.string().min(1).optional()
 });
 //#endregion
 export { DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema };

package/dist/protocol/messages/event-log.d.ts

@@ -16,12 +16,12 @@ import { z } from 'zod';
  *   the message.
  */
 export declare const EventLogStatus: z.ZodEnum<{
-    failed: "failed";
-    received: "received";
-    processed: "processed";
     duplicate: "duplicate";
-    lockfile_missing: "lockfile_missing";
+    failed: "failed";
     lockfile_corrupt: "lockfile_corrupt";
+    lockfile_missing: "lockfile_missing";
+    processed: "processed";
+    received: "received";
 }>;
 export type EventLogStatus = z.infer<typeof EventLogStatus>;
 /**
@@ -46,8 +46,8 @@ export type PayloadOmittedReason = z.infer<typeof PayloadOmittedReason>;
  * - `direct` — Direct HTTP ingress (independent / hybrid mode).
  */
 export declare const EventLogSource: z.ZodEnum<{
-    relay: "relay";
     direct: "direct";
+    relay: "relay";
 }>;
 export type EventLogSource = z.infer<typeof EventLogSource>;
 //# sourceMappingURL=event-log.d.ts.map